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A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
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• Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event, however, may a reply be timely filed 
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Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). 
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1 )|EI Responsive to communication(s) filed on 07 December 2007 . 
2a)K This action is FINAL. 2b)D This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 
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4) E3 Claim(s) 1-37 is/are pending in the application. 
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Response to Amendment 

1 . This action is responsive to the amendment filed on December 07, 2007. 
Claims 1, 2, 4-13, 17-20, 22-31, 34-35 and 37 are amended. Claims 1-37 are 
pending. 

2. The applicant should always use the period for response to thoroughly 
and very closely proof read and review the whole of the application for correct 
correlation between reference numerals in the textual portion of the Specification 
and Drawings along with any minor spelling errors, general typographical errors, 
accuracy, assurance of proper use for Trademarks ™, and other legal symbols 
®, where required, and clarity of meaning in the Specification, Drawings, and 
specifically the claims (i.e., provide proper antecedent basis for "the" and "said" 
within each claim). Minor typographical errors could render a Patent 
unenforceable and so the applicant is strongly encouraged to aid in this 
endeavor. 

Specification 

3. The specification is objected to as failing to provide proper antecedent 

basis for the claimed subject matter See 37 CFR 1.75(d)(1) and MPEP 
§ 608.01 (o). Correction of the following is required: Proper antecedent basis is 
required for newly added limitation "the requester privacy statement describes 
how each of the requested data-subject data will be used by the requester" 

Claim Rejections - 35 USC §112 
The following is a quotation of the first paragraph of 35 U.S.C. 112: 
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The specification shall contain a written description of the invention, and of the manner and process of 
making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the 
art to which it pertains, or with which it is most nearly connected, to make and use the same and shall 
set forth the best mode contemplated by the inventor of carrying out his invention. 

4. Claims 1 and 19 are rejected under 35 U.S.C. 112, first paragraph, as 
failing to comply with the written description requirement. The claim(s) contains 
subject matter which was not described in the specification in such a way as to 
reasonably convey to one skilled in the relevant art that the inventor(s), at the 
time the application was filed, had possession of the claimed invention. 
Applicant's specification failed to provide sufficient description for the newly 
added limitation "the requester privacy statement describes how each of the 
requested data-subject data will be used by the requester". 

The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

5. Claims 1 and 19 are rejected under 35 U.S.C. 112, second paragraph, as 
being indefinite for failing to particularly, point out and distinctly claim the subject 
matter which applicant regards as the invention. It is unclear and indefinite to the 
examiner what applicant meant by "the requester privacy statement describes 
how each of the requested data-subject data will be used by the requester" 

Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 

U.S.C. 1 02 that form the basis for the rejections under this section made in this 
Office action: 
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A person shall be entitled to a patent unless - 

(e) the Invention was described in a patent granted on an application for patent by another filed in the 
United States before the invention thereof by the applicant for patent, or on an international application 
by another who has fulfilled the requirements of paragraphs (1), (2), and (4) of section 371(c) of this 
title before the invention thereof by the applicant for patent. 

The changes made to 35 U.S.C. 102(e) by the American Inventors Protection 
Act of 1999 (AIPA) and the Intellectual Property and High Technology Technical 
Amendments Act of 2002 do not apply when the reference is a U.S. patent 
resulting directly or indirectly from an international application filed before 
November 29, 2000. Therefore, the prior art date of the reference is determined 
under 35 U.S.C. 102(e) prior to the amendment by the AIPA (pre-AlPA 35 U.S.C. 
102(e)). 

6. Claims 1-37 are rejected under 35 U.S.C. 102(e) as being anticipated by 

O'Flaherty et al. (U.S. Patent Number 6,275,824) hereinafter referred as 
O'Flaherty. 

O'Flaherty teaches the invention as claimed including a method for 
managing data privacy in a database management system. Storing and retrieving 
data from a plurality of database tables wherein the data in the database tables is 
controllably accessible according to privacy parameters store din the database 
table (See abstract). 

As to claim 1 , O'Flaherty teaches A system to enforce privacy preferences 
on exchanges of personal data of a data-subject, the system comprising of one 
or more computers connected to one or more networks through one or more 
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network interfaces, each computer having one or more memories and one or 
more central processing units (CPUs), the system further comprising: 

one or more data-subject authorization rule sets stored in the one or more 
memories that has one or more subject constraints on release of one or more 
data-subject data (abstract) ; 

a receiving process, executing on the one or more CPUs, that receives a 
request message from a requester over the network interfaces, the request 
message having one or more requests for one or more of the data-subject data 
releases pertaining to a subject, and a requester privacy statement for each of 
the respective data-subject data requested, (abstract, Column 4, lines 30-Column 
5, lines 63); and 

a release process executing on the one or more CPUs that compares the 
requester privacy statement to the subject constraints and releases the data- 
subject data in a response message to the requester only if the subject 
constraints are satisfied (abstract, Column 4, lines 30-Column 5, lines 63). 

As to claim 2, O'Flaherty teaches a system, as in claim 1, where the 
requester also has to be authorized to receive the private data (Column 4, lines 
49-Column 5, lines 16). 

As to claim 3, O'Flaherty teaches a system, as in claim 2, where there is 
more than one level of authorization (Column 4, lines 49-Column 5, lines 16). 

As to claim 4, O'Flaherty teaches a system, as in claim 1, wherein each of 
the subject constraints further comprises: 
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an authorization dataset describing the data to which the constraint 
applies (Column 1, lines 28-Column 2, line,s 20; Column 2, lines 57-Column 3, 
lines 21); 

a privacy preference rule that describes the privacy preferences under 
which the data may be released and the corresponding actions allowed (Column 
1, lines 28-Column 2, lines 20; Column 2, lines 57-Column 3, lines 21); 

an access list describing who is allowed to access the data (Column 1 , 
lines 28-Column 2, lines 20; Column 2, lines 57-Column 3, lines 21); and 

an authorization action that describes any additional action to be taken if 
the restrictions imposed by the authorization dataset, the privacy preference rule 
and the access list of this constraint are matched (Column 1, lines 28-Column 2, 
lines 20; Column 2, lines 57-Column 3, lines 21). 

As to claim 5, O'Flaherty teaches a system, as in claim 1 , wherein the 
private, subject data release further comprises: 

one or more subject data that is owned and held by the data-subject 
(Column 2, lines 57-Column 3, lines 21); 

one or more subject data that is owned by the data-subject, but held by 
one or more parties on behalf of the data subject (Column 2, lines 57-Column 3, 
lines 21); and 

one or more subject data that is owned and held by one or more third 
parties (Column 2, lines 57-Column 3, lines 21). 
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As to claim 6, O'Flaherty teaches a system, as in claim 1 , where one or 
more of the requesters have to satisfy different subject rule sets for the same 
private data (Column 4, lines 30-Column 5, lines 63). 

As to claim 7, O'Flaherty teaches a system, as in claim 1 , where the 
private, subject data release is partitioned into a first part that satisfies the 
constraints and is released and a second part that does not satisfy the 
constraints and is not released (Column 4, lines 30-Column 5, lines 63). 

As to claim 8, O'Flaherty teaches a system, as in claim 1 , wherein the 
private, subject data released further comprises one or more data for which 
additional manual authorization from the subject is needed before the data is 
released (Column 4, lines 30-Column 5, lines 63). 

As to claim 9, O'Flaherty teaches a system, as in claim 1 , wherein the 
private, subject data released further comprises one or more missing values 
which have to be acquired from the subject before the data is released (Column 
4, lines 30-Column 5, lines 63). 

As to claim 10, O'Flaherty teaches a system, as in claim 1, wherein 
private, subject data released further comprises one or more data that is stored 
with one or more third parties and has to be retrieved from the third parties 
before the private, subject data release can be released (Column 5, lines 64- 
Column 6, lines 12). 

As to claim 1 1 , O'Flaherty teaches a system, as in claim 1 , wherein the 
private, subject data released further comprises one or ore data that is stored 
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with one or more third parties and the third parties have to be provided with 
authorization to release the data to the requester (Column 5, lines 64-Column 6, 
lines 12). 

As to claim 12, O'Flaherty teaches a system, as in claim 1 , where the 
private, subject data release to which each constraint applies comprises one or 
more of the following: 

one or more classes of data, one or more properties of data, and one or 
more instances of data (abstract). 

As to claim 13, O'Flaherty teaches a system, as in claim 1, where the 
private, subject data release is ordered in a hierarchy with one or more levels 
and each of the levels has one or more constraints that apply to the respective 
private, subject data release in the level (abstract, Column 2, lines 57-Column 3, 
lines 21). 

As to claim 14, O'Flaherty teaches a system, as in claim 13, where one or 
more of the levels have different constraints (abstract, Column 4, lines 30- 
Column 5, lines 63). 

As to claim 15, O'Flaherty teaches a system, as in claim 13, where one or 
more of the levels inherits one or more of the constraints from one or more other 
levels (abstract, Column 4, lines 30-Column 5, lines 63). 

As to claim 16, O'Flaherty teaches a system, as in claim 13, where the 
level to which each constraint applies further comprises one or more of the 
following: 
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one or more classes of data, one or more properties of data, and one or 
more instances of data (abstract, Column 4, lines 30-Column 5, lines 63). 

As to claim 17, O'Flaherty teaches a system, as in claim 1, where the 
constraints include privacy preferences based on any one or more of the 
Platform for Privacy Preferences (P3P) standard privacy statements, including a 
purpose, a retention, a recipient and an access (abstract, Column 4, lines 30- 
Column 5, lines 63). 

As to claim 18, O'Flaherty teaches a system, as in claim 1, where the data 
includes any one or more of the following: 

a privacy data, a privacy data associated with a natural person, a 
confidential information, and a trade secret (abstract, Column 1, lines 28-Column 
2, lines 20). 

Claims 19-37 do not teach or define any new limitations other than above 
claims 1-18. Therefore, rejected for similar reasons. 
7. Examiner's Note: Examiner has cited particular columns and line 

numbers in the references as applied to the claims above for the convenience of 
the applicant. Although the specified citations are representative of the teachings 
of the art and are applied to the specific limitations within the individual claim, 
other passages and figures may apply as well. It is respectfully requested from 
the applicant in preparing responses, to fully consider the references in its 
entirety as potentially teaching of all or part of the claimed invention, as well as 
the context. 
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Response to Arguments 

8. Applicant's arguments have been fully considered but they are not 
persuasive. 

In the remarks applicant argues in substance that; A) O'Flaherty does not 
teach a requester privacy statement describes how each of the requested data- 
subject data will be used by the requester. 

In response to A) The newly added limitation is not supported by the 
applicant's specification. Therefore, the examiner is not consider it at this time. 

Conclusion 

9. Applicant's amendment necessitated the new ground(s) of rejection 
presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. 
See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as 
set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire 
THREE MONTHS from the mailing date of this action. In the event a first reply is 
filed within TWO MONTHS of the mailing date of this final action and the advisory 
action is not mailed until after the end of the THREE-MONTH shortened statutory 
period, then the shortened statutory period will expire on the date the advisory 
action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be 
calculated from the mailing date of the advisory action. In no event, however, will 
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the statutory period for reply expire later than SIX MONTHS from the date of this 
final action. 

10. Any inquiry concerning this communication or earlier communications from 

the examiner should be directed to Faruk Hamza whose telephone number is 
571-272-7969. The examiner can normally be reached on Monday through 
Friday. 

If attempts to reach the examiner by telephone are unsuccessful, the 
examiner's supervisor, Saleh Najjar can be reached at 571-272-4006. The fax 
phone number for the organization where this application or proceeding is 
assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from 
the Patent Application Information Retrieval (PAIR) system. Status information 
for unpublished applications is available through Private PAIR only. For more 
information about the PAIR system, see http://pair-direct.uspto.gov . Should you 
have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 886-217-9197 (toll -free). 
Faruk Hamza 
Patent Examiner 
Group Art Unite 2155 




